<format>
  <regular-grammar>
    <head-re><![CDATA[^
(?<ClientIP>[^\,]+)\,\  # Client IP (v4 or v6)
(?<UserName>[^\,]+)\,\  # User Name
(?<M>\d{1,2})\/(?<D>\d{1,2})\/(?<Y>\d+)\,\   # Date
(?<H>\d{1,2})\:(?<m>\d{1,2})\:(?<S>\d{1,2})\,\  # Time
(?<Service>[^\,]+)\,\  # Service and instance
(?<Server>[^\,]+)\,\  # Server name
(?<ServerIP>[^\,]+)\,\  # Server IP (v4 or v6)
(?<TimeTaken>\d+|\-)\,\  # Time taken
(?<ClientBytes>\d+|\-)\,\  # Client bytes sent
(?<ServerBytes>\d+|\-)\,\  # Server bytes sent
(?<ServiceStatus>\d+|\-),\  # Service status code
(?<WindowsStatus>\d+|\-),\  # Windows status code
(?<Request>.+?|\-)\,\  # Request type
(?<Target>.+?|\-)\,\  # Target of operation
(?<Params>.+?|\-)\,  # The parameters that are passed to a script]]></head-re>
    <fields-config>
      <field name="Time"><![CDATA[new DateTime(PARSE_YEAR(Y), TO_INT(M), TO_INT(D), TO_INT(H), TO_INT(m), TO_INT(S))]]></field>
      <field name="Body" code-type="function"><![CDATA[StringBuilder ret = new StringBuilder();
for (int i = 0; i < INPUT_FIELDS_COUNT(); ++i) 
{
	string value = INPUT_FIELD_VALUE(i);
	string name = INPUT_FIELD_NAME(i);
	if (name.Length == 1) // DateTime realetd captures (M, D, Y, H, m, S)
		continue;
	if (value == "-") // no-value string (-)
		continue;
	if (ret.Length > 0)
		ret.Append(", ");
	ret.AppendFormat("{0}={1}", name, value);
}
return ret.ToString();]]></field>
      <field name="Severity"><![CDATA[ServiceStatus == "200" ? Severity.Info : Severity.Warning]]></field>
    </fields-config>
    <patterns />
    <encoding>ACP</encoding>
    <sample-log><![CDATA[::1, -, 2/23/2013, 12:12:46, W3SVC1, MSA3644463, ::1, 324, 285, 935, 200, 0, GET, /, -,
::1, -, 2/23/2013, 12:12:46, W3SVC1, MSA3644463, ::1, 5, 337, 185196, 200, 0, GET, /welcome.png, -,
::1, -, 2/23/2013, 12:12:46, W3SVC1, MSA3644463, ::1, 3, 238, 5375, 404, 2, GET, /favicon.ico, -,
::1, -, 2/23/2013, 12:12:50, W3SVC1, MSA3644463, ::1, 1, 238, 5375, 404, 2, GET, /favicon.ico, -,
::1, -, 2/23/2013, 12:12:52, W3SVC1, MSA3644463, ::1, 1, 370, 210, 304, 0, GET, /, -,
::1, -, 2/23/2013, 12:12:52, W3SVC1, MSA3644463, ::1, 2, 423, 211, 304, 0, GET, /welcome.png, -,
::1, -, 2/23/2013, 12:12:57, W3SVC1, MSA3644463, ::1, 1, 292, 935, 200, 0, GET, /, ksadjf,]]></sample-log>
  </regular-grammar>
  <id company="Microsoft" name="IIS" />
  <description>IIS log files in the Microsoft IIS Log File Format.</description>
</format>